# Campaign 003 session recovery deployment and A/B resume

Status: complete
Type: evidence
Updated: 2026-08-17
Next Action: Observe both `sdq-controller-*-camp003-million.service` runners through all eight 129600/AFTER iterations, then adjudicate exact terminal/export evidence against the trusted oracle and approved latency budget.
Campaign: 003-complete-bounded-hpt-slow-export-firmware-ticket

## Outcome

- The cross-campaign HPT2 session-recovery blocker is resolved by SD Qualifier
  commit `e8d0d073e1b7f9a02a32acb6c3632a9b500aa2db` on branch
  `codex/camp003-session-recovery-20260817`.
- The correction accepts a historical acknowledged Start only when a later
  campaign has the same controller role and physical sample, the exact CID and
  candidate bundle, a different nonzero boot witness, an immutable passing
  initialization-continuity adjudication linked to the exact power-cycle and
  observer operations, and a later immutable HPT2 measurement-admission
  observation. Same-boot, wrong-card, wrong-bundle, and untrusted-admission
  evidence remain fail closed.
- Focused tests passed: the live-shaped positive case, four negative identity/
  trust cases, and the existing same-campaign qualified-power-interruption case
  all passed (`6/6`). A broader 43-test class run reached 40 passes; its two
  evidence-path errors and one stale UI expectation were pre-existing test-
  container/harness conditions outside this correction.
- Candidate image
  `srv-rpi00-sd-qualifier:camp003-session-recovery-e8d0d07` has image SHA-256
  `e41f65af64f7e3a45b83654a2a24031be95d4c58a1deb7178235c1c5134ce2f9`.
  The deployed web container is healthy and reports release identity
  `camp003-session-recovery-e8d0d07` and the exact source commit above.
- A read-only live dry run accepted all three historical Controller A unmatched
  Start rows only through the exact current admission evidence. No database
  migration, controller command, or evidence mutation occurred during that
  dry run.
- Protected Compose override:
  `/home/jong/.local/share/sd-qualifier/camp003-session-recovery-e8d0d07-compose.override.yaml`.
  The former `independent-ab-8cdfa3b` override remains available, and both
  qualification-supervisor environment files have exact
  `.rollback-camp003-e8d0d07` copies.

## Resume state

- Controller A service: `sdq-controller-a-camp003-million.service`, active.
- Controller A run: `3ea798ce-df69-4d4b-b838-ce1800dcf762`.
- Controller A Start: `3693fad9-b110-4c1e-a176-018bd61ceaf0`, `ACKNOWLEDGED`.
- Controller A checkpoint: state `2`, checkpoint `1`, attempted/committed/
  verified `1457/1457/1457`, terminal reason `0`.
- Controller B service: `sdq-controller-b-camp003-million.service`, active.
- Controller B run: `9e5e9b17-972d-4355-af19-3731769aefe0`.
- Controller B Start: `72375e50-2a82-42ce-a1a5-4d80d0c5b7ad`, `ACKNOWLEDGED`.
- Controller B checkpoint: state `2`, checkpoint `4`, attempted/committed/
  verified `69022/69021/69021`, terminal reason `0`.
- Both runners are Pi-hosted transient user services and continue independently
  of this workstation.

## CID identity evidence

The baseline captures below are from the current campaign immediately after
the qualified power-cycle operations and are linked to the exact read-only
observer results. CID is identity evidence, not authenticity proof.

### Controller A — capture 404

- Protocol card status: `SD_STATE_READY;DETECTION_READY;DRIVER_STATUS=0`.
- CID valid: `true`; representative-sector read valid: `true`.
- Manufacturer: SanDisk; MID: `0x05`; OEM/application ID: `0x000C`.
- Product: `asdfg`; revision: `2.2`; serial: `7305`; manufacturing date:
  `2026-03`.
- Raw 128-bit CID: `05000C61736466672200001C8901A34F`.
- Power-cycle operation: `5c32566c-3620-424a-a4fc-188359ebb4ab`.
- Read-only observer: `547a5853-c9a1-431a-a142-439d57cea955`, result SHA-256
  `d370f049c23ac47df1ba84729a3fd94d05da48eea6eab5018f3c8c186c06bb00`.

### Controller B — capture 405

- Protocol card status: `SD_STATE_READY;DETECTION_READY;DRIVER_STATUS=0`.
- CID valid: `true`; representative-sector read valid: `true`.
- Manufacturer: SanDisk; MID: `0x05`; OEM/application ID: `0x000C`.
- Product: `asdfg`; revision: `2.2`; serial: `7298`; manufacturing date:
  `2026-03`.
- Raw 128-bit CID: `05000C61736466672200001C8201A379`.
- Power-cycle operation: `025aace0-649c-48d3-ae8d-fe1778cecd4d`.
- Read-only observer: `65326158-3e49-4c4b-8c9b-9be286fdcf19`, result SHA-256
  `46b7e6b54aab45579e99c015ba03193ae31e9c8d4d44d0e181fcd582cb02040b`.

## Safety and authority

- No SD card was removed or inserted while powered.
- No USB drive move was requested or performed.
- Controller A used the existing immutable envelope
  `1a9729b4-ab1a-4e42-af72-afebaa347e63`, exact campaign/bundle/CID identity,
  and a fresh machine intent. Controller B retained its existing authorized run.
- The non-final firmware bundle remains bound in the protected registry while
  physical campaign execution is active.
